Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,867 detections
Filters
Last updated
All Time
Detection languages
1,758
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,469
11,856
5,880
5,161
4,867
Platforms
3,712
737
613
406
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
889
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This rule monitors for patterns associated with the Gamaredon (ACTINIUM) threat group's PowerShell loaders (e.g., Ptero-family) and the Kazuar backdoor. It specifically detects indicators such as malicious PowerShell command lines, NTFS alternate data stream manipulation, and suspicious scheduled task creation.
Detects the creation of a 'keylogger.dat' file within the Windows APPDATA Roaming directory. This specific file path is a known artifact generated by Remcos RAT when utilizing its offline keylogger capability, which relies on the SetWindowsHookExA API with the WH_KEYBOARD_LL hook to intercept keystrokes.
Detects the behavior of the Remcos RAT watchdog process, which monitors the main malware execution. The rule identifies the creation of a specific registry marker (HKCU\SOFTWARE\{MUTEX}\WD) used by the watchdog for state tracking, combined with the malicious process spawning a target executable (svchost.exe, rmclient.exe, or fsutil.exe) from a standard Remcos installation directory.
This rule detects the execution of processes where the command line contains keywords commonly associated with malware, specifically 'backdoor', 'rootkit', or 'trojan'. It monitors Windows Security Event ID 4688 (a process creation event) and flags any command lines containing these terms.
This rule detects an unusually high number of executable (.exe or .msi) file creations within common installation or binary folders (containing 'setup', 'install', or 'bin' in their path) by a single process within a one-hour window. This behavior could indicate the staging or unpacking of malicious software, or a legitimate but potentially suspicious installation activity.
Detects the presence of file artifacts associated with known keyloggers (keylogger.dat, remcos.log) or files containing 'keylog' within the AppData\Roaming directory, which is a common persistence location for malware.
This rule detects persistence mechanisms and process execution patterns associated with the Remcos Remote Access Trojan (RAT). It monitors Registry run key modifications pointing to known Remcos installation paths, as well as process lineage involving Remcos and its associated watchdog processes (svchost.exe, rmclient.exe, fsutil.exe).
Detects execution of a SimpleRunPE-style loader from common user-writable directories such as Downloads, Temp, AppData, or Public paths. This behavior is often associated with malware attempting to evade detection by executing from non-standard locations.
Detects the LokiBot information stealer establishing persistence via a Windows Run key. The detection looks for registry key modifications under HKCU that follow a specific pattern: the registry value points to an executable located within the %APPDATA% directory inside a short, six-character hexadecimal subdirectory. The rule further validates this behavior by monitoring for key names derived from the C2 infrastructure components, such as IP addresses or specific PHP script names, commonly observed in builder-generated LokiBot samples.
Detects the final payload stage of LokiBot infostealer, characterized by a 32-bit Windows PE file built with MSVC 2015. The rule identifies specific known malicious file hashes or a structural signature featuring a non-standard PE section named 'x', which is used by the malware to store 3DES-encrypted C2 endpoint addresses.
Detects the creation of archive files (ZIP, RAR, 7Z) or executables with specific naming conventions (GST_, Debit_, Invoice_, NEFT_, RTGS_) often associated with Remcos RAT loaders. This rule focuses on the initial file creation event on a device.
This rule detects secondary Command and Control (C2) communication associated with the Remcos RAT loader. It identifies suspicious network connections to specific IP addresses, domains (including those often used by malicious actors like .bit, .onion, .su, .cc), and remote ports commonly utilized by Remcos.
This rule detects the execution of PowerShell or batch scripts that mimic legitimate Realtek audio services, a known tactic used by AsyncRAT. Specifically, it looks for process command lines containing "RealtekAudioService64.ps1", "RealtekAudioService64.bat", "RealtekAudioEnhancements64.ahk", or "RtkNGUI64.ahk".
This rule detects the use of password derivation functions (like argon2id, scrypt, pbkdf2) in command lines, which can be indicative of ransomware activity, specifically associated with Prinz Eugen. It focuses on processes like 'servertool.exe', 'encrypt.exe', and 'powershell.exe' initiating these commands.
Detects process parent ID (PPID) spoofing where a process spawned by SystemSettings.exe claims a parent that is not SystemSettings.exe, svchost.exe, services.exe, or explorer.exe. This behavior is indicative of SharkLoader attempting to disguise Cobalt Strike Beacon process lineage using UpdateProcThreadAttribute/PROC_THREAD_ATTRIBUTE_PARENT_PROCESS. The rule also looks for suspicious process paths associated with SharkLoader.
Detects the Prinz Eugen ransomware's encryption binary ('servertool.exe') spawning common system utilities ('cmd.exe', 'powershell.exe', 'net.exe', 'wmic.exe', 'taskkill.exe'). This behavior is indicative of the ransomware preparing the system for encryption or performing post-encryption cleanup/actions.
Identifies the ScreenConnect Client Service initiating network traffic to the domain 'directdownload.icu', which has been associated with cryptojacking campaigns. This activity indicates potential compromise and resource hijacking.
Detects a banking trojan process establishing TLS communication immediately after loading input, capture, and overlay modules. The rule specifically looks for network connections initiated by processes with names like 'banana', 'client', 'update', 'service', or 'host' (case-insensitive) and command lines indicating SSL/TLS communication or remote control functionality.
Detects modification or replacement of a trusted-looking executable or DLL located in a directory writable by standard users. This rule specifically looks for file write events (NewExecutableWritten, FileWritten, FileCreateInfo, FileDeleteInfo) where the target file is an executable (.exe) or dynamic link library (.dll) and is located in common world-writable directories such as \Users\Public\, \ProgramData\, \AppData\, or \Temp\. Additionally, it filters for processes whose command line or base file name suggests a loader, updater, or common command-line utilities (cmd.exe, powershell.exe) initiating these writes, indicating potential masquerading or DLL hijacking.
Detects a batch or PowerShell loader reading 'msedge.txt' from a writable path (Temp, AppData, Downloads, ProgramData) and treating its content as encoded executable data. This behavior is indicative of the Banana RAT malware.
Detects a banking overlay process showing an update, validation, or security-maintenance message while suppressing interaction with the real browser. This behavior is characteristic of certain banking Trojans or RATs that aim to trick users into providing credentials or other sensitive information by presenting a fake security update or maintenance prompt that overlays legitimate browser windows.
Page 107 of 232